global-github-repository-setup
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/setup-github-repository.shusesgitandgh(GitHub CLI) to interact with the local repository and the GitHub API. These actions are performed under user supervision with explicit confirmation prompts.\n- [EXTERNAL_DOWNLOADS]: The script runsnpx --yes github-label-sync, which fetches and executes a package from the NPM registry. This is a common practice for accessing development utilities.\n- [COMMAND_EXECUTION]: The provided workflow templates reference external GitHub Actions (robvanderleek/create-issue-branchanddawidd6/action-delete-branch). These dependencies are added to the target repository configuration.\n- [CREDENTIALS_UNSAFE]: The script manages GitHub tokens for authentication. It avoids persistent storage by using temporary environment variables and secure interactive input (read -s), and it unsets the token immediately after execution to prevent accidental exposure.\n- [PROMPT_INJECTION]: The skill processes repository metadata which represents an attack surface for indirect content injection.\n - Ingestion points: Repository name and owner retrieved via
gh repo view.\n - Boundary markers: The script includes mandatory
confirmprompts before writing files or syncing data.\n - Capability inventory: The script can modify the
.githubdirectory and interact with the GitHub API.\n - Sanitization: Input variables are quoted and handled within a robust shell script environment (
set -euo pipefail).
Audit Metadata